TACACS for user in multiple groups

[John.Mason1978]

hi

Quick question about TACACS and a user that needs to be in more than 1 group

We have a networkAdmins group that is linked to the AD domain Admins group with a network admin in it

w then have another group for firewalls which is linked to firewall access group in AD one user is in both groups which have both been created using a manual mapping in TACACS but the user is only showing up in the NetworkAdmin group not in the firewall admin group

any ideas why the user is not showing up or is this even possible

thanks                  

[nspasov]

Hello John-

You can have a user be part of more than one group. You just need to make sure that both of the groups are pulled from AD and then you can build your authorization rules based on that.

Let me know if this makes sense or if you need more details.

[John.Mason1978]

Hi Neo

thanks for the fast reply

that makes sense

so my user for example currently is in the network admins group populated via AD but there are ACS local users in that group

if i remove the local users then the ad should populate both groups with my user

[nspasov · Accepted solution]

No problem! I have had issues in the past when the local and the domain user are the same. You can still get around that by defining what identity stores are used (for example, excluding the internal user database) and/or by properly constructing your authorization rules.

Also, do are you using ACS 4.x or 5.x?

Thank you for rating!

[John.Mason1978]

Yes I inherrited this system, its version 4 and this excercise has prompted us to redesign the acs

Thanks for your help

[nspasov]

Those are always nice when you inherit these type of systems. I don't know if you have had any experience with 5.x but I highly recommend migrating to it. It is much nicer in terms of building blocks, logging, monitoring etc and it does not run on Windows